Usernames can be enumerated
Effort to fix: Quick win (under an hour)
Why it matters
The public REST API users route hands attackers valid usernames, which is half of every login attack.
How to fix it
Restrict the users REST endpoint to authenticated requests.
On WordPress
Use a security plugin option, or filter rest_endpoints to unset '/wp/v2/users' for logged-out visitors; also block ?author= scans.